using Microsoft.IdentityModel.Tokens;

using PrivaPub.ClientModels;
using PrivaPub.ClientModels.User;
using PrivaPub.Models.User;

using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using System.Text;

namespace PrivaPub.StaticServices
{
	public class AuthTokenManager
	{
		public const string SessionStamp = "ss";
		const string SessionStampClaim = SessionStamp;//the root's RootUser.SessionStamp when issued; JwtEvents refuses a stale one
		// one sign-in on one device: its tokens, renewals included, carry the same id, so signing out ends that device alone
		// (RootUser.EndedSessions). Not "sid", which JwtBearer maps to another claim type on the way in.
		public const string SessionId = "si";

		readonly IConfiguration Configuration;

		public AuthTokenManager(IConfiguration configuration)
		{
			Configuration = configuration;
		}

		public TimeSpan Lifetime => TimeSpan.FromHours(int.Parse(Configuration["AppConfiguration:Jwt:HoursTimeout"]));

		/// <summary>A token for the root; a renewal passes the session it renews, a new sign-in gets a new one.</summary>
		public JwtUser GenerateToken(RootUser user, ViewUserSettings userSettings, string sessionId = default)
		{
			var expiration = DateTime.UtcNow + Lifetime;
			var securityKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Configuration["AppConfiguration:Jwt:Key"]));
			var jwtUser = new JwtUser
			{
				UserId = user.ID,
				Email = user.Email,
				Username = user.UserName,
				Expiration = expiration.Ticks,
				Policies = user.Policies,
				UserSettings = userSettings
			};
			var claims = new List<Claim>
			{
				new(ClaimTypes.UserData, user.ID),
				new(ClaimTypes.Name, user.UserName),
				new(SessionStampClaim, user.SessionStamp ?? string.Empty),
				new(SessionId, string.IsNullOrEmpty(sessionId) ? Guid.NewGuid().ToString("N") : sessionId)
			};

			claims.Add(new(Policies.IsUser, $"{user.Policies.Contains(Policies.IsUser)}".ToLower()));
			claims.Add(new(Policies.IsModerator, $"{user.Policies.Contains(Policies.IsModerator)}".ToLower()));
			claims.Add(new(Policies.IsAdmin, $"{user.Policies.Contains(Policies.IsAdmin)}".ToLower()));

			var token = new JwtSecurityToken(issuer: Configuration["AppConfiguration:Jwt:Issuer"], audience: Configuration["AppConfiguration:Jwt:Audience"],
					claims: claims,
					notBefore: DateTime.UtcNow,
					expires: expiration,
					signingCredentials: new(securityKey, SecurityAlgorithms.HmacSha512)
			);
			var tokenHandler = new JwtSecurityTokenHandler();
			jwtUser.Token = tokenHandler.WriteToken(token);
			return jwtUser;
		}
	}
}